yunsip | eabf410fcd4155c910ef62282497f4fcca4ed0efe2526e58b13cebdeb530972c

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30-01-2023 02:00

Target

eabf410fcd4155c910ef62282497f4fcca4ed0efe2526e58b13cebdeb530972c.dll
Size

674KB
MD5

0bdcd181a88e8438de52fda0ceca43e0
SHA1

3bf94dd8bdb8041a61dd4045167d35843928bc62
SHA256

eabf410fcd4155c910ef62282497f4fcca4ed0efe2526e58b13cebdeb530972c
SHA512

bc91bc309118af5ec34263aceb2265dcc4c77a626704012d0e188c931e7c9ea0956b560fbf43075349e4ceb995c8cf7fbf509b238ff8cf3796b57d2b8aa2de0d
SSDEEP

3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0S:jDgtfRQUHPw06MoV2nwTBlhm8a

Score

10^/10

Yunsip
Remote backdoor which communicates with a C2 server to receive commands.
trojan banker yunsip

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 504 wrote to memory of 3804	504	rundll32.exe	81
PID 504 wrote to memory of 3804	504	rundll32.exe	81
PID 504 wrote to memory of 3804	504	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eabf410fcd4155c910ef62282497f4fcca4ed0efe2526e58b13cebdeb530972c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\eabf410fcd4155c910ef62282497f4fcca4ed0efe2526e58b13cebdeb530972c.dll,#1
  2⤵
  PID:3804